How to Scrape LinkedIn Sales Navigator (2026)

I spent a week trying to get clean lead lists out of LinkedIn Sales Navigator for a B2B outreach build, and the first thing I learned is that “how to scrape LinkedIn Sales Navigator” is a different problem from scraping public LinkedIn. Sales Navigator is a paid search product layered on top of LinkedIn, every result sits behind your logged-in seat, and there is no public page to fetch. So the question is not “can I read the HTML” but “how do I get the data out without burning my account.”

Below is what I ran in July 2026: the caps LinkedIn enforces on a search, the Python session-cookie route and exactly why it is risky, and the cookie-free route I settled on that returns parsed lead JSON. Where a method drives a live seat, I say so and I do not pretend I ran it against a real account.

Can you scrape LinkedIn Sales Navigator?

You can scrape LinkedIn Sales Navigator data, but only through your own logged-in seat or by resolving the public profiles behind a search, because Sales Navigator has no public page and no self-serve API. The search results, lead lists, and account lists all render only after you authenticate with a paid seat, so there is no logged-out URL to request the way there is for a public /in/ profile.

The official API is not a way around this for most teams. LinkedIn’s Sales Navigator and Sales Insights APIs live inside the LinkedIn Sales Solutions partner program, which is enterprise-gated, negotiated directly, and priced for large contracts. There is no endpoint where a normal Core seat passes a search and receives lead rows. That leaves two real routes, and they differ mainly in what account carries the risk:

• Drive your own seat. A browser extension or a headless-browser script reuses your logged-in Sales Navigator session to read the search you built. It sees your private filters, and it puts your account on the line.
• Resolve public data instead. You use Sales Navigator to identify targets, collect their profile and company URLs, then fetch those public pages through a scraper API that never touches your session. It does not read your private filters, but it keeps the risk off your seat.

Neither route unlocks private, connection-only fields, and that is the honest ceiling. What both can return is the lead data most outreach actually needs, so the next thing to pin down is which fields are on the table and how many rows a single search will give you.

What data can you extract from Sales Navigator?

The data worth extracting from Sales Navigator is lead data and account data: the contact and firmographic fields a B2B team runs outreach on, pulled from a people search, an account search, or a saved list. For each lead you can get the full name, job title, current company, location, and the LinkedIn profile URL. For each account you can get the company name, industry, size, and the company URL. Emails are never in the interface, so a verified email is always a separate enrichment step.

Two hard caps shape every job, and they are the reason large pulls need planning. A Sales Navigator people search shows only the first 2,500 results (100 pages of 25), and an account search shows only the first 1,000. Anything past those ceilings is silently dropped, so a target audience bigger than 2,500 has to be split into narrower segments (by geography, headcount band, or industry) before extraction. I split every search I ran, and it is the single practice that keeps a list complete.

The native export is thinner than people expect. LinkedIn’s Sales Navigator plan pages advertise CSV upload and CRM sync for getting data into the tool, not out of it, and a raw people search has no export button at all. Newer versions added a limited CSV export for a saved lead list, but it is capped well below a full search and returns no emails or phone numbers. CRM sync is reserved for the Advanced Plus tier at custom pricing. For a normal Core seat at $119.99 per month or an Advanced seat at $159.99 per month, getting a usable list out means a scraper or an API, which brings us to the actual procedure, starting with the search itself.

Step 1: Build and save your Sales Navigator search

Start by building the search inside Sales Navigator, because the quality of your extraction is decided by the filters, not the scraper. Open a people search, apply the filters that define your ICP (title, seniority, company headcount, geography, industry), and check the result count against the 2,500 ceiling before you do anything else. If the count is higher, tighten a filter or split the search into segments now, while it is cheap to do.

Once the count sits under the cap, save it as a search or push the matching leads into a saved lead list. The saved-search URL is what you copy for the next step, and it looks like this:

https://www.linkedin.com/sales/search/people?query=(...)&start=0

The start parameter paginates in steps of 25, so page two is start=25, page three is start=50, up to start=2475 for the hundredth and final page. If you are collecting for the cookie-free route in Step 3, the goal of this step is different: you walk the pages once to harvest the profile URLs (the /sales/lead/ or /in/ links) into a list, then resolve those URLs to full records through the API. Either way, you now have a bounded, filtered search. The two ways to turn it into rows are a script that drives your seat, or an API that works from the public pages, and I tested both.

Step 2: Scrape a Sales Navigator search with Python

You scrape a Sales Navigator search with Python by driving your logged-in seat with a real browser, because the results only render behind authentication. The session is carried by the li_at cookie that LinkedIn sets when you log in, and the most reliable pattern is Playwright loading a saved session state, navigating the paginated search URL, and reading the lead cards off the rendered DOM.

Here is the shape of that script. It loads a saved login, walks the search 25 results at a time under the 2,500 cap, and pulls the core fields out of each card:

import asyncio
from playwright.async_api import async_playwright

SEARCH = "https://www.linkedin.com/sales/search/people?query=(...)"

async def scrape_sales_nav():
    leads = []
    async with async_playwright() as p:
        browser = await p.chromium.launch(headless=False)
        # storage_state.json holds a logged-in Sales Navigator session
        context = await browser.new_context(storage_state="storage_state.json")
        page = await context.new_page()

        for start in range(0, 2500, 25):          # 100 pages max, then the cap hits
            await page.goto(f"{SEARCH}&start={start}")
            await page.wait_for_timeout(4000)      # let cards render, stay human-paced
            cards = await page.query_selector_all("li.artdeco-list__item")
            if not cards:
                break                              # no more results
            for card in cards:
                name = await card.query_selector("span[data-anonymize='person-name']")
                title = await card.query_selector("span[data-anonymize='title']")
                company = await card.query_selector("a[data-anonymize='company-name']")
                leads.append({
                    "name": (await name.inner_text()).strip() if name else None,
                    "title": (await title.inner_text()).strip() if title else None,
                    "company": (await company.inner_text()).strip() if company else None,
                })
        await browser.close()
    return leads

asyncio.run(scrape_sales_nav())

I did not run this against a live Sales Navigator seat, for the same reason I give in my Python LinkedIn guide: automating a personal, paid account is the fastest way to a restriction, and I will not risk a real seat for a demo. The mechanics are real and this is the pattern people use, so the failure modes are worth naming.

Two of them bite hardest. The first is selector churn: Sales Navigator obfuscates and rotates its class names, so li.artdeco-list__item or a data-anonymize attribute can move between releases, and when it does the script returns empty fields with no error. You find out when your CSV has blank columns, so check your field hit rate on every run. The second is account risk, which is not a bug you can code around. Every page load counts against your seat, LinkedIn watches pace and pattern, and pushing past a human cadence trips the behavioral detection. That risk is the whole reason I moved the job off my own session, which is Step 3.

Step 3: Get lead data as JSON without your seat

The cookie-free route turns your collected Sales Navigator URLs into structured lead JSON through a scraper API, with the residential proxies, browser rendering, and retries handled server-side and your own seat never touching the job. You already have the profile and company URLs from Step 1. Here you resolve each one to a full record, which sidesteps the li_at cookie, the selector churn, and the ban risk in a single move.

In my testing I used ChocoData’s LinkedIn endpoint, which takes a public profile URL and an API key and returns the parsed fields. A single lead is one request:

curl "https://chocodata.com/api/v1/linkedin/profile?url=https://www.linkedin.com/in/williamhgates&api_key=$CHOCO_API_KEY"

The Python version loops the URLs you harvested from the Sales Navigator search and drops the results straight into a list of rows, ready for pandas or a CSV:

import requests, os

# Profile URLs collected from your Sales Navigator search in Step 1
profile_urls = [
    "https://www.linkedin.com/in/williamhgates",
    "https://www.linkedin.com/in/satyanadella",
]

leads = []
for url in profile_urls:
    resp = requests.get(
        "https://chocodata.com/api/v1/linkedin/profile",
        params={"url": url, "api_key": os.environ["CHOCO_API_KEY"]},
        timeout=30,
    )
    lead = resp.json()
    leads.append((lead["name"], lead.get("headline"), lead.get("company")))

for name, headline, company in leads:
    print(name, "-", headline, "-", company)

This returned clean lead records without a session cookie, a CSRF token, or a proxy pool on my side, and the same call scales across thousands of URLs because each request is independent and the rotation happens server-side. For account lists, swap the path to the linkedin/company endpoint and pass the company URLs instead, which returns industry, size, and headquarters for each account. The honest tradeoff is scope: because it works from public data, it does not read your private Sales Navigator filters, so you still build the target search yourself and let the API do the extraction. The free tier covers 1,000 requests, which is enough to test a real segment before you commit. Whichever route you pick, the thing that actually keeps a project alive is not getting your account flagged, so that is worth its own section.

How do you avoid getting banned scraping Sales Navigator?

You avoid a ban by keeping automated activity off your own seat, and where that is not possible, by slowing the request rate and using a clean IP. The exposure is simple: any method that reuses your logged-in session (a browser extension, a cookie-based script, or a headless login) runs activity tied to your real account, and that is what LinkedIn’s behavioral detection is built to catch. These are the levers that change the outcome, in rough order of impact:

• Prefer a cookie-free API. Fetching public profile and company data through a service that rotates its own residential IPs means your Sales Navigator seat never appears in the job, which removes the account risk entirely rather than managing it.
• If you must drive your seat, slow down. Practitioners widely keep a logged-in account under roughly 100 to 200 profile views a day with multi-second, randomized gaps. Sequential, machine-paced access is the clearest bot signal.
• Use residential IPs, not datacenter. A logged-in session from a flagged datacenter range draws scrutiny fast. A clean residential connection at a human pace is the least likely to trip a restriction.
• Cache what you already pulled. The cheapest request is the one you skip. Store the lead and account IDs you have and fetch only the deltas on the next run.

LinkedIn spells out the rule directly. Its prohibited software and extensions policy bans scraping tools and warns that using them can restrict or close an account, and enforcement in practice is a suspension, not a lawsuit. That is why the safest architecture treats your seat as read-only for building searches and pushes the actual extraction onto infrastructure that carries no account of yours. The legal picture sits alongside that account risk, and the two are often confused, so it is worth separating them.

Is scraping LinkedIn Sales Navigator legal?

Scraping public LinkedIn data is treated as legal in the US, but Sales Navigator data is not public, so the legal frame is different and mostly about contract, not the CFAA. The Ninth Circuit held in hiQ Labs v. LinkedIn that scraping publicly accessible data likely does not violate the Computer Fraud and Abuse Act. That ruling protects logged-out, public pages. Sales Navigator sits behind a paid login, so it falls outside the public-data safe harbor and lands squarely under LinkedIn’s contract.

That contract is the User Agreement, and Section 8.2 prohibits members from using “software, devices, scripts, robots, or any other means or processes (including crawlers, browser plugins and add-ons, or any other technology) to scrape the Services or otherwise copy profiles and other data.” Because Sales Navigator scraping happens inside an authenticated session, that clause applies to the seat doing it, and the same hiQ case ended with a $500,000 judgment against hiQ for breach of contract tied to its use of the platform. The enforcement you are most likely to meet is an account restriction, not a court, but the contract risk is real and it attaches to whoever’s login is used.

The practical takeaway separates the two questions cleanly. Extracting public profile and company data has firm legal footing after hiQ, while extracting data through your paid Sales Navigator session is a terms-of-service matter that can cost you the account. You are also responsible for what you do with the data downstream, especially outreach, which brings in personal-data rules such as the GDPR regardless of how you collected it. I walk through the full picture in my guide on whether scraping LinkedIn is legal. This is general information, not legal advice.

Which method should you choose?

Choose by whether you can afford to put your Sales Navigator seat at risk and how much volume you need. Here is the summary I give people who ask.

For most teams doing steady outreach, building the search on your seat and resolving the collected URLs through a cookie-free API was the cleanest split in my testing: you keep Sales Navigator’s filtering, and the extraction never risks your login. If you want the ranked tool comparison and pricing instead of the procedure, I cover the field in my roundup of the best LinkedIn scrapers. Start by building one tightly filtered search under the 2,500 cap, and decide from there whether the volume justifies moving the extraction off your seat.